diff --git a/build/ci/qemu-version b/build/ci/qemu-version
index e92657bfdf2..aa8f709e77b 100644
--- a/build/ci/qemu-version
+++ b/build/ci/qemu-version
@@ -5,4 +5,4 @@
 # declaration the guest image is held to, never a fact read off it. The image
 # digest is chosen to satisfy this line; changing either is a deliberate act:
 # it says the instrument moved.
-11.1.2
+11.1.3
diff --git a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
index b9af7ac3447..115f99fe09a 100644
--- a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
+++ b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md
@@ -24,7 +24,7 @@ arrives and is not one. M4 and M5 are stages of `issues/toyos-builds-itself.md`.
 | the toolchain's own `clang`, `llvm-ar`, `rust-lld` and `llvm-config`, built from `ToyOSOrg/llvm-project` | rustc links every guest binary with `rust-lld`; `clang` compiles the C corpus (`tests/common/compile.rs`) and, with `llvm-ar`, through `cc::Build` the C of every guest crate that has any (`build/clang.rs`, `build/build.rs`'s `GuestEnv`): doomgeneric, and ring's C and assembly in a test crate's `https_get` and `ring_kat`; rustc's bootstrap asks `llvm-config` how to link LLVM | admitted: our fork's C++, which ToyOS can one day build and run; no Rust tool compiles C, `cc::Build` archives with an `ar`, bootstrap reads LLVM through `llvm-config`, and `CLAUDE.md` links everything with `rust-lld` | M5: no host in the loop |
 | `ovmf-generic`, `qemu-efi-aarch64` | the x86-64 and AArch64 UEFI firmware of CI's guest containers and of the guest runner's host (`build/firmware.rs`), packaged by Debian apart from QEMU | admitted: QEMU's own firmware, and no Rust firmware does its job | the instrument's QEMU carries its own firmware |
 | `ca-certificates` | the trust store `git` and `curl` verify against in CI's containers | admitted: data both of them need | goes when neither runs there |
-| Debian's `sid` image, Docker Hub's `sid-20260918` copied once to `ghcr.io/toyosorg/debian` and pulled with the run's token | the container of `guest.yml`'s suite, pinned to digest `a2aa4626…`, whose dated snapshot archive `deps` installs QEMU from; and, pulled anonymously from ECR Public's copy of Docker Hub's, of `nightly.yml`'s `portability-linux`, `sid` as it stands | admitted: the runner's Ubuntu 24.04 publishes QEMU 8.2.2 (Launchpad, noble, every pocket) and that snapshot archive carries QEMU 11.1.1; `build/ci/qemu-version` now declares 11.1.2, the guest runner's (`issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md`) | the runner's own OS carries the declared QEMU, or the build system builds it |
+| Debian's `sid` image, Docker Hub's `sid-20260918` copied once to `ghcr.io/toyosorg/debian` and pulled with the run's token | the container of `guest.yml`'s suite, pinned to digest `a2aa4626…`, whose dated snapshot archive `deps` installs QEMU from; and, pulled anonymously from ECR Public's copy of Docker Hub's, of `nightly.yml`'s `portability-linux`, `sid` as it stands | admitted: the runner's Ubuntu 24.04 publishes QEMU 8.2.2 (Launchpad, noble, every pocket) and that snapshot archive carries QEMU 11.1.1; `build/ci/qemu-version` now declares 11.1.3, the guest runner's and the dev host's (`issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md`) | the runner's own OS carries the declared QEMU, or the build system builds it |
 | GitHub's Actions runner on the guest runner's host | takes `guest-rows.yml`'s jobs | admitted: the owner's ruling (2026-11-04) runs guest tests on a dedicated self-hosted runner; it is the agent every GitHub-hosted job already runs under | goes with GitHub Actions |
 | Docker on the runner | Actions pulls and runs every `container:` image with it, those two jobs' | refused: Go, not C or C++ ToyOS can one day build and run, and Actions runs a `container:` with Docker alone | the container goes with the image row |
 | `skopeo` | `skopeo copy --all --preserve-digests` copied Docker Hub's `sid-20260918` index, every manifest by its digest, to `ghcr.io/toyosorg/debian`, once, from a `run:` step of a workflow that ran on a branch and is not in `main`; a new pin is a new copy made the same way, and the copy it replaces is deleted | refused: Go, not C or C++ ToyOS can one day build and run | a Rust tool makes the copy, or the container goes with the image row |
diff --git a/issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md b/issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md
index d5d87a72044..3ff48f4099d 100644
--- a/issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md
+++ b/issues/the-nightly-is-frozen-so-nothing-runs-the-guest-matrix.md
@@ -15,8 +15,9 @@ writer, main's toolchain release, and the fresh-machine and macOS builds.
 Guest rows run only where an agent dispatches them on the guest runner
 (`guest-rows.yml`), so a regression in a row no PR selected goes unseen.
 
-`build/ci/qemu-version` moved to 11.1.2, the guest runner's QEMU, while
-`guest.yml`'s container still installs 11.1.1 from its snapshot archive, so its
-instrument step reds until the container moves to an image carrying 11.1.2.
+`build/ci/qemu-version` moved to 11.1.3, the guest runner's and the dev host's
+QEMU, while `guest.yml`'s container still installs 11.1.1 from its snapshot
+archive, so its instrument step reds until the container moves to an image
+carrying 11.1.3.
 
-**Exit**: the nightly resumes, its guest container on 11.1.2. Held by the owner.
+**Exit**: the nightly resumes, its guest container on 11.1.3. Held by the owner.